What is the reason of opening UDP listen port by xray?

[resiliencer]

I am running xray 1.8.7 on my newly created vps. What is the reason of opening UDP listen port by xray? Is it backdoor? I don't need weird listen ports. Looks strange. Can anyone explain this please?

root@xxx# ss -pnul
State      Recv-Q     Send-Q         Local Address:Port          Peer Address:Port     Process                               
UNCONN     0          0                          *:51242                    *:*         users:(("xray",pid=1998,fd=12))

My config here:

{ "log": { "loglevel": "warning" },
  "routing": { "rules": [
{"type": "field", "protocol":["icmp"], "outboundTag": "block"},
{"type": "field", "protocol":["dns"], "outboundTag": "warp"},
{"type": "field", "port":53, "outboundTag": "warp"},
{"inboundTag": ["in_vless", "in_dns"],"outboundTag": "warp"} 
], "domainStrategy": "UseIPv4" 
},
  "inbounds": [ 
{ "listen": "XXX", "port": XXX, "protocol": "vless", "tag": "in_vless",
            "settings": { "clients": [
                    { "id": "XXX", "flow": "xtls-rprx-vision" },
                    { "id": "XXX", "flow": "xtls-rprx-vision" }
                ], "decryption": "none" },
            "streamSettings": { "network": "tcp", "security": "reality",
                "realitySettings": {
                    "show": false,
                    "dest": "www.microsoft.com:443",
                    "xver": 0,
                    "serverNames": [ "www.microsoft.com"  ],
                    "privateKey": "XXX",
                    "shortIds": [  "XXX", "XXX" ] } },
	    "sniffing": { "enabled": false, "destOverride": ["http", "tls"]  } } ],
    "outbounds": [
        {
            "protocol": "freedom",
            "proxySettings": {                "tag": "warp"            },
            "settings": {                "domainStrategy": "UseIPv4"            },
            "tag": "warp-IPv4"
        },
        {
            "protocol": "freedom",
            "proxySettings": {                "tag": "blocked"            },
            "settings": {                "domainStrategy": "UseIPv6"            },
            "tag": "warp-IPv6"
        },
        {
            "protocol": "wireguard",
            "settings": {

	  	  "secretKey": "XXX",  "address": [ "XXX" ],
		  "peers": [   {  "endpoint": "XXX", "publicKey": "XXX" }  ],
		  "kernelmode": false,
		  "reserved": [0, 0, 0]
		  ,"domainStrategy": "ForceIPv4"
            },
            "tag": "warp"
        }, { "protocol": "blackhole", "tag": "blocked" }
    ]
}

[qwerr0]

I think it's related to UDP FullconeNAT

[uuonda]

@chise0713 Yes I know there is no client/server in wireguard, it's all just peers. But I'm pretty sure this port is for incoming connections from other peers only if you act like a "server".

[chise0713]

@uuonda No, it always needs a port whether is "server" or "client" you are acting.
Just act a "client" then check wg command, I'll be damned, why there's a "listening port"?

interface: wgcf
  public key: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
  private key: (hidden)
  listening port: 54093

[uuonda]

@chise0713

Just act a "client" then check wg command, I'll be damned, why there's a "listening port"?

Exactly! If you are running wireguard as outbound proxy there is no point for that port to be open. You can block it on your firewall.

If you try to configure wireguard "server" that would be the port for your clients to connect to. Why else would it listen on 0.0.0.0?

[chise0713]

Exactly! If you are running wireguard as outbound proxy there is no point for that port to be open. You can block it on your firewall.

No, you never wants to do it, this port is also for the "client" to communicate the "server".

If you try to configure wireguard "server" that would be the port for your clients to connect to. Why else would it listen on 0.0.0.0?

Because it always listen to 0.0.0.0 and [::]. In wireguard-tools tool-chain, you don't even have a place for setting listen address.
And like what I said, the port is for other peers to communicate with the peer, if you block it on firewall, you will not able to use wireguard to access other peers.
So why did I say "it doesn't have 'client-server' structure" ? Because it allows every other peers to communicate with the peer, there's no "server-client" thing in here, you can even let "server" use "client" to access the network, it is by your setting, your NAT and/or PBR, this protocol needs this port, it's by design.
Edit:
And why is 0.0.0.0?
Refer: https://t.me/projectXray/3517921

[uuonda]

@chise0713 I see, thanks. I hope you are right.

But is it safe to keep this port open on 0.0.0.0? Would someone be able to detect wireguard on my server? I don't even run a wg "server".

[Fangliding]

UDP is a message-oriented protocol. The meaning of "listen a port" is slightly different from TCP. In short, if a program want to communicate with a UDP port, the sender must listen a port first.